CVE-2021-3011

An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access and consequently produce a...

jackson-databind: Lacks certain xbean-reflect/JNDI blocking

A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A "gadget" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availabili...

PT-2020-15510 · Jenkins · Jenkins Lockable Resources Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Lockable Resources Plugin versions 2.8 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to reserve, unreserve, unlock, and reset resources. This issue arises because the plugin does not require...

Navigate CMS Cross-Site Scripting Vulnerability (CNVD-2020-49437)

Navigate CMS is a powerful and intuitive content management system. A cross-site scripting vulnerability exists in the Content module of Navigate CMS 2.9. This vulnerability can be exploited by attackers to conduct cross-site scripting attacks...

CVE-2020-23655

NavigateCMS 2.9 is affected by Cross Site Scripting XSS on module "Configuration."...

Solidus Input Validation Error Vulnerability

Solidus is an open source e-commerce system. An input validation error vulnerability exists in Solidus versions prior to 2.8.6, prior to 2.9.6, and prior to 2.10.2. The vulnerability stems from a network system or product that does not properly validate incoming data. No detailed vulnerability...

Mida Solutions eFramework Cross-Site Scripting Vulnerability

Mida Solutions eFramework is a suite of unified communications and collaboration services from Mida Solutions, Italy. A cross-site scripting vulnerability exists in Mida Solutions eFramework version 2.9.0 and earlier. The vulnerability stems from a lack of proper validation of client-side data by...

Naviwebs Navigate CMS Cross-Site Scripting Vulnerability (CNVD-2020-35980)

Naviwebs Navigate CMS is an open source content management system CMS from Naviwebs, Inc. in the United States. A cross-site scripting vulnerability exists in Naviwebs Navigate CMS version 2.9 r1433. The vulnerability stems from a lack of proper validation of client-side data by the WEB...

Naviwebs Navigate CMS Authorization Issues Vulnerability

Naviwebs Navigate CMS is an open source content management system CMS from Naviwebs, Inc. in the United States. A security vulnerability exists in the password recovery feature in Naviwebs Navigate CMS version 2.9 r1433, which originates from a notfound message being returned when the user name o...

jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery SSRF attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization...

CVE-2020-5730

In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting...

PYSEC-2020-206

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxosfilecopy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS...

wolfSSL buffer overflow vulnerability (CNVD-2020-13495)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A buffer overflow vulnerability exists in wolfSSL CyaSSL versions prior to 2.9.4. The vulnerability stems from a networked system or...

wolfSSL buffer overflow vulnerability (CNVD-2020-13496)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. wolfSSL A buffer overflow vulnerability exists in the 'DoAlert' function in versions of CyaSSL prior to 2.9.4. The vulnerability stems...

CVE-2019-3486

Mitigates a stored cross site scripting issue in ArcSight Security Management Center versions prior to 2.9.1...

CVE-2019-10137

A path traversal flaw was found in spacewalk-proxy, all versions through 2.9, in the way the proxy processes cached client tokens. A remote, unauthenticated attacker could use this flaw to test the existence of arbitrary files, if they have access to the proxy's filesystem, or can execute arbitra...

spacewalk spacewalk-proxy path traversal vulnerability

spacewalk is an open source Linux system management solution. spacewalk-proxy is one of the proxy programs. A path traversal vulnerability in spacewalk spacewalk-proxy version 2.9, which arises from a failure of a networked system or product to properly filter special elements in the path of a...

PT-2018-13775

Name of the Vulnerable Software and Affected Versions Ansible Engine versions prior to 2.9 Description The issue allows for 'become' passwords to appear in EventLogs in plaintext when executing Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled. ...

Rausoft ID.prove SQL Injection Vulnerability

Rausoft ID.prove is a list auditing module. The module is capable of auditing and tracking a company's customer, supplier and employee information against a blacklist. A SQL injection vulnerability exists in the login page of Rausoft ID.prove version 2.95. A remote attacker can exploit this...

CVE-2018-2802

Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications subcomponent: Client Application Loader. Supported versions that are affected are 2.8 and 2.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...